First published: Tue Oct 22 2019(Updated: )
A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
Credit: security@mozilla.org security@mozilla.org
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/firefox | <0:68.2.0-4.el6_10 | 0:68.2.0-4.el6_10 |
redhat/thunderbird | <0:68.2.0-2.el6_10 | 0:68.2.0-2.el6_10 |
redhat/firefox | <0:68.2.0-1.el7_7 | 0:68.2.0-1.el7_7 |
redhat/thunderbird | <0:68.2.0-1.el7_7 | 0:68.2.0-1.el7_7 |
redhat/firefox | <0:68.2.0-2.el8_0 | 0:68.2.0-2.el8_0 |
redhat/thunderbird | <0:68.2.0-1.el8_0 | 0:68.2.0-1.el8_0 |
redhat/firefox | <68.2 | 68.2 |
redhat/thunderbird | <68.2 | 68.2 |
Mozilla Thunderbird | <68.2 | 68.2 |
Mozilla Firefox ESR | <68.2 | 68.2 |
Mozilla Firefox | <70 | 70 |
Mozilla Firefox | <70.0 | |
Mozilla Firefox ESR | <68.2 | |
Mozilla Thunderbird | <68.2 | |
Canonical Ubuntu Linux | =16.04 | |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/firefox | <70.0 | 70.0 |
ubuntu/firefox | <70.0+ | 70.0+ |
ubuntu/thunderbird | <1:68.2.1+ | 1:68.2.1+ |
ubuntu/thunderbird | <1:68.2.1+ | 1:68.2.1+ |
ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
ubuntu/thunderbird | <68.2 | 68.2 |
ubuntu/thunderbird | <1:68.7.0+ | 1:68.7.0+ |
debian/firefox | 125.0.3-1 | |
debian/firefox-esr | 91.12.0esr-1~deb10u1 115.10.0esr-1~deb10u1 115.7.0esr-1~deb11u1 115.10.0esr-1~deb11u1 115.7.0esr-1~deb12u1 115.10.0esr-1~deb12u1 115.10.0esr-1 | |
debian/thunderbird | 1:91.12.0-1~deb10u1 1:115.10.1-1~deb10u1 1:115.7.0-1~deb11u1 1:115.10.1-1~deb11u1 1:115.7.0-1~deb12u1 1:115.10.1-1~deb12u1 1:115.10.1-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
(Found alongside the following vulnerabilities)
The vulnerability ID for this issue is CVE-2019-11760.
This vulnerability affects Firefox versions prior to 70, Thunderbird versions prior to 68.2, and Firefox ESR versions prior to 68.2.
CVE-2019-11760 has a severity rating of 8.8 (high).
A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling, leading to a potentially exploitable crash.
To fix CVE-2019-11760, update your Firefox to version 70 or later, Thunderbird to version 68.2 or later, or Firefox ESR to version 68.2 or later.